Navigation transitions: Plumb data from the outgoing renderer to the incoming renderer

content/browser/transition_request_manager.h

Index: content/browser/transition_request_manager.h
diff --git a/content/browser/transition_request_manager.h b/content/browser/transition_request_manager.h
index 48be189ca50e0dfb7016dd909116bba22187f122..4f6334679c4d1bab8885d2f0bf0cc722aba461ad 100644
--- a/content/browser/transition_request_manager.h
+++ b/content/browser/transition_request_manager.h
@@ -5,7 +5,8 @@
 #ifndef CONTENT_BROWSER_TRANSITION_REQUEST_MANAGER_H_
 #define CONTENT_BROWSER_TRANSITION_REQUEST_MANAGER_H_
 
-#include <set>
+#include <map>
+#include <string>
 #include <utility>
 #include <vector>
 
@@ -20,9 +21,21 @@ struct DefaultSingletonTraits;
 namespace net {
 class HttpResponseHeaders;
 }
+class GURL;
 
 namespace content {
 
+// This struct passes data about an imminent transition between threads.
+struct TransitionLayerData {
+  TransitionLayerData();
+  ~TransitionLayerData();
+
+  std::string markup;
+  std::string css_selector;
+  scoped_refptr<net::HttpResponseHeaders> response_headers;
+  GURL request_url;
+};
+
 // TransitionRequestManager is used to handle bookkeeping for transition
 // requests and responses.
 //
@@ -42,28 +55,66 @@ class TransitionRequestManager {
       const GURL& resolve_address);
 
   // Returns whether the RenderFrameHost specified by the given IDs currently
-  // has a pending transition request. If so, we will have to delay the
+  // has any pending transition request data. If so, we will have to delay the
   // response until the embedder resumes the request.
-  bool HasPendingTransitionRequest(int process_id, int render_frame_id);
-
-  // Sets whether the RenderFrameHost specified by the given IDs currently has a
-  // pending transition request.
-  CONTENT_EXPORT void SetHasPendingTransitionRequest(int process_id,
-                                                     int render_frame_id,
-                                                     bool has_pending);
+  bool HasPendingTransitionRequest(int render_process_id,
+                                   int render_frame_id,
+                                   const GURL& request_url,
+                                   TransitionLayerData* transition_data);
+
+  // Adds pending request data for a transition navigation for the
+  // RenderFrameHost specified by the given IDs.
+  CONTENT_EXPORT void AddPendingTransitionRequestData(
+      int render_process_id,
+      int render_frame_id,
+      const std::string& origin,
+      const std::string& css_selector,
+      const std::string& markup);
+
+  void ClearPendingTransitionRequestData(int render_process_id,
+                                         int render_frame_id);
 
  private:
+  class TransitionRequestData {
+   public:
+    TransitionRequestData();
+    ~TransitionRequestData();
+    void AddEntry(const std::string& origin,
+                  const std::string& selector,
+                  const std::string& markup);
+    bool FindEntry(const GURL& request_url,
+                    TransitionLayerData* transition_data);
+
+   private:
+    struct AllowedEntry {
+        // These strings could have originated from a compromised renderer,

[Charlie Reis, 2014/08/05 20:58:14]

Need 2 space indent here as well.

[oystein (OOO til 10th of July), 2014/08/06 22:36:19]

Done.

+        // and should not be trusted or assumed safe.

[Charlie Reis, 2014/08/05 20:58:14]

I like your explanation in the review comment.  Let's add: "They are only used
within a sandboxed iframe with scripts disabled."

[oystein (OOO til 10th of July), 2014/08/06 22:36:19]

Done.

+        std::string origin;
+        std::string css_selector;
+        std::string markup;
+
+        AllowedEntry(const std::string& origin,
+                     const std::string& css_selector,
+                     const std::string& markup) :
+            origin(origin),
+            css_selector(css_selector),
+            markup(markup) {}
+    };
+    std::vector<AllowedEntry> allowed_entries_;
+  };
+
   friend struct DefaultSingletonTraits<TransitionRequestManager>;
-  typedef std::set<std::pair<int, int> > RenderFrameSet;
+  typedef std::map<std::pair<int, int>, TransitionRequestData>
+      RenderFrameRequestDataMap;
 
   TransitionRequestManager();
   ~TransitionRequestManager();
 
-  // Set of (render_process_host_id, render_frame_id) pairs of all
-  // RenderFrameHosts that have pending transition requests. Used to pass
-  // information to the CrossSiteResourceHandler without doing a round-trip
-  // between IO->UI->IO threads.
-  RenderFrameSet pending_transition_frames_;
+  // Map of (render_process_host_id, render_frame_id) pairs of all
+  // RenderFrameHosts that have pending cross-site requests and their data.
+  // Used to pass information to the CrossSiteResourceHandler without doing a
+  // round-trip between IO->UI->IO threads.
+  RenderFrameRequestDataMap pending_transition_frames_;
 
   DISALLOW_COPY_AND_ASSIGN(TransitionRequestManager);
 };